Hacker News Reader

Comment by linschn | Hacker News Reader

It's not to late for French citizens to call their representatives.

Find who to call here : http://www.assemblee-nationale.fr/14/qui/circonscriptions/?h...

And point them to there : https://sous-surveillance.fr/#/

and there : https://wiki.laquadrature.net/Amender_le_PJL_Renseignement

Talk about it online and IRL, and once the law inevitably pass, install Enigmail and TrueCrypt on your relative's computers.

View on HN

Don't forget to install Signal on iOS and Redphone/Textsecure on Android: https://whispersystems.org/

I had respect for TextSecure until they actually removed the ability to secure text messages.

Now, rather than "here's a way to secure your existing communication path" it's become a game of "become reliant on having a working data connection, our cloud service and google's push service if you want to communicate".

It's not even as though I can choose to stay on an older version to keep the SMS functionality without forcing all of my friends to never upgrade it either (many of whom already have, if only accidentally).

Colour me exceedingly unimpressed -especially as in the 2 years I've been using TextSecure, I and all the friends I've tried to convert have had nothing but issues with the push. This whole thing has left a bad taste in my mouth and has made me rather angry.

There's a fork which re-enables SMS encryption.

OWS do have a point about SMS metadata leakage though.

http://smssecure.org/

I don't share your view. Encrypted SMS functionality was not ready for the masses with the key exchanges, meta data leakage and was source of many bugs. Now users are never confronted with keys and other scary stuff :) Furthermore, most of my friends have switched from WhatsApp, so they did not use the encrypted SMS functionality in the first place.

I'm very impressed with the apps Whisper Systems have delivered. Please support them to accelerate development for even better encrypted communications!

Are the "masses" and existing users (who have learned to use the existing functions) mutually exclusive? Was there a large maintenance burden to support the existing feature?

It was a large maintenance burden: "It’s holding us back. Dealing with all the corner cases associated with the encrypted SMS/MMS transport prevents us from dedicating focus and attention to make the overall product better." https://whispersystems.org/blog/goodbye-encrypted-sms/

Except that the whole point of me wanting to use TextSecure is the encrypted SMS/MMS transport. How would removing the one feature that actually stands out make for a better product?

Hmm, I've never quite managed to find what all these problematic corner cases actually are.

The bit that jumps out from your link is the fact they now support iOS, and iOS won't let them programatically send/receive SMS. It seems to be a case of "now we support iOS, to keep feature parity, we're stripping out our main feature!" -I insert my own <slowclap /> at this point.

So, TrueCrypt has been audited[0][1], but abandoned.

Do we use it as it is, or use a fork that will be more up-to-date?

Can we actually fork it? Some comments on [1] mention that it's illegal to fork it. Others point to existing forks.

I am just confused about what to do, or even what other people are doing.

What are the thoughts of the HN community regarding TrueCrypt?

[0] http://istruecryptauditedyet.com/

[1] http://blog.cryptographyengineering.com/2015/04/truecrypt-re...

Use it. 7.1a has been shown safe. Watch https://truecrypt.ch/ for news about any developments (CipherShed and/or VeraCrypt) as well as being a trusted source for 7.1a.

If you do a cursory search on the audit, you will find the discussion here about the second link. Generally, TrueCrypt seems to be trustworthy still. Forks generally seem permissible, but must not use the TrueCrypt name. While forks may not technically be allowed, making any sort of claim against a forked project would require the authors of TrueCrypt to de-anonymize themselves, which seems unlikely.

That being said, this article is about data in transit, and TrueCrypt protects data at rest. I'm sure there is a better place to be having this conversation about TrueCrypt.

Why would you use TrueCrypt rather than a maintained, properly-open-source system? dm-crypt / cryptsetup-luks is maintained, secure, and ordinary GPL, and I believe there's a windows implementation. You probably can't use it for your root disk on windows, but if you're serious about security you're probably not running the millions of lines of closed, potentially-backdoored code that is windows.

And if you want to take action, but need to build critical mass, you may use: https://www.iWouldDo.it

support caliopen too.

https://caliopen.org https://blog.caliopen.org

Reply on news.ycombinator.com